Описание
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the lib/plugin.php file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a file inclusion issue with the api_plugin_hook() function in the lib/plugin.php file, which reads the plugin_hooks and plugin_config tables in database. The read data is directly used to concatenate the file path which is used for file inclusion. Version 1.2.27 contains a patch for the issue.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.2.27+ds1-2 |
| esm-apps/bionic | released | 1.1.38+ds1-1ubuntu0.1~esm3 |
| esm-apps/focal | released | 1.2.10+ds1-1ubuntu1.1 |
| esm-apps/jammy | released | 1.2.19+ds1-2ubuntu1.1 |
| esm-apps/noble | released | 1.2.26+ds1-1ubuntu0.1 |
| esm-apps/xenial | released | 0.8.8f+ds1-4ubuntu4.16.04.2+esm2 |
| esm-infra-legacy/trusty | released | 0.8.8b+dfsg-5ubuntu0.2+esm2 |
| focal | released | 1.2.10+ds1-1ubuntu1.1 |
| jammy | released | 1.2.19+ds1-2ubuntu1.1 |
| mantic | ignored | end of life, was needs-triage |
Показывать по
Ссылки на источники
EPSS
8 High
CVSS3
Связанные уязвимости
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a file inclusion issue with the `api_plugin_hook()` function in the `lib/plugin.php` file, which reads the plugin_hooks and plugin_config tables in database. The read data is directly used to concatenate the file path which is used for file inclusion. Version 1.2.27 contains a patch for the issue.
Cacti provides an operational monitoring and fault management framewor ...
Уязвимость функции api_plugin_hook() программного средства мониторинга сети Cacti, позволяющая нарушителю выполнить произвольный код
EPSS
8 High
CVSS3